Kodezen vulnerabilities
We track 8 vulnerabilities in Kodezen products across 6 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on October 24, 2026.
Latest Kodezen vulnerabilities
- 8.8 High severity
aBlocks – Gutenberg Blocks, User Dashboard…: Improper Privilege Management
The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the `/ablocks/v1/form-builder/registration` REST
- 7.1 High severity
aBlocks: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC aBlocks ablocks allows Reflected XSS.This issue affects aBlocks: from n/a through 2.16.0.
- 8.8 High severity
aBlocks: Incorrect Privilege Assignment
Incorrect Privilege Assignment vulnerability in Kodezen LLC aBlocks ablocks allows Privilege Escalation.This issue affects aBlocks: from n/a before 2.9.1.
- 8.0 High severity
Academy LMS Pro: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows Upload a Web Shell to a Web Server. This issue affects Academy LMS Pro: from n/a before 3.5.2.
- 9.8 Critical severity
Academy LMS – WordPress LMS Plugin for…: Authorization Bypass Through User-Controlled Key
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.5.0. This is due to the plugin not properly validating a user's ident
- 7.2 High severity
Academy LMS – WordPress LMS Plugin for…: Deserialization of Untrusted Data
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.8 via deserialization of untrusted input in the 'import_all_courses' function. This make
- 8.8 High severity
StoreEngine — Complete eCommerce Solution with…: Unrestricted Upload of File with Dangerous Type
The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import() function in all versions up to, and inclu
- 8.8 High severity
Academy LMS – WordPress LMS Plugin for…: Improper Privilege Management
The Academy LMS – eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.9.19. This is due to plugin allowing arbitrary user meta updates through the saved_user_info